GNISREVER A POLYMORPHIC FILE-INFECTING RANSOMWARE … 1... · Malware Honeycomb virus POS bot...

GNISREVER A POLYMORPHIC FILE-INFECTING RANSOMWARE November 10-11, 2016

Raul Alvarez

About Me

Senior Security

Researcher @ Fortinet

22 published articles in

Virus Bulletin

Regular contributor in our

company blog

Confidential

Malware Categories

trojan

script/

Malware Honeycomb

virus POS

botnet

worm ransom

trojan

script/

Virlock

virus POS

botnet

worm ransom

Agenda

Confidential

Virlock as a common malware

• Reversing stages

• Metamorphic algorithm

Virlock as a file infector

• Detection

• Extracting the host file

Virlock as a polymorphic malware

• On-demand polymorphic algorithm

Virlock as a ransomware

• Visible signs

• Unlocking

Virlock

What Is A File Infector?

Confidential

Attaches the malware code into the host file.

Appending, prepending, and cavity type

Maintains persistency within the computer system

Infected file is hard to restore

What Is A Ransomware?

Confidential

Holds your computer for ransom

Encrypts files

Uses cryptocurrency, such as bitcoins, for payment

What Is Virlock?

Confidential

A ransomware

A file infector

Uses on-demand polymorphic algorithm

Uses metamorphic algorithm

Locks your screen

19 Confidential

Just kidding!

Debugging Tools

Confidential

ollydbg

http://www.ollydbg.de/

immunity debugger

http://www.immunityinc.com/p

roducts/debugger/

x64dbg

http://x64dbg.com/

Virlock As A Common Malware

Common Reversing

Confidential

encrypted/

packed

decryptor

MZ header

Decrypting/Unpacking

malware using a

debugger

decrypted/

unpacked

decryptor

MZ header

Static/Dynamic

Analysis

Reversing Stages

Confidential

.text 0xbb000

.rsrc 0x01200

metamorphic

algorithm 0x06C77

MZ header MZ header

.rsrc 0x01200

MZ header

decoded bytes 0x0250

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

metamorphic

algorithm 0x06C77

main functions

Virlock-infected file only

has 2 sections: .text and

Reversing Stages

Confidential

.text 0xbb000

.rsrc 0x01200

metamorphic

algorithm 0x06C77

MZ header MZ header

.rsrc 0x01200

MZ header

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

metamorphic

algorithm 0x06C77

main functions

At the entry point, the

malware executes its

metamorphic algorithm.

Reversing Stages

Confidential

.text 0xbb000

.rsrc 0x01200

metamorphic

algorithm 0x06C77

MZ header MZ header

.rsrc 0x01200

MZ header

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

metamorphic

algorithm 0x06C77

main functions

The metamorphic

algorithm decodes

the initial decryptor.

Reversing Stages

Confidential

.text 0xbb000

.rsrc 0x01200

metamorphic

algorithm 0x06C77

MZ header MZ header

.rsrc 0x01200

MZ header

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

metamorphic

algorithm 0x06C77

main function

The initial decryptor

produces the main

function.

Reversing Stages

Confidential

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

Host file

The main function calls

the malicious threads

and other sub-

functions. Each sub-

function is

decrypted/re-

encrypted by individual

on-demand

polymorphic algorithm.

Reversing Stages

Confidential

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

Host file

When an on-demand

polymorphic algorithm

runs, it decrypts the

malicious code and

executes them. Then

re-encrypts itself and

the malicious code

with a different key.

Reversing Stages

Confidential

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

Host file

After executing the

rest of the

malicious code, the

malware in

memory looks

totally different

from its original

binary content.

Reversing Stages

Confidential

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

Host file

Finally, the host file

is decrypted,

dropped, and

executed.

Metamorphic Algorithm

Confidential

Basics:

Putting a value(0) in a register(EAX)

MOV EAX,0 EAX register gets 0 directly

XOR EAX,EAX XORing the same register by itself also

generates a zero value placed into a given

register

SUB EAX,EAX SUBtracting any register by itself also

generates the same result.

MOV EAX, 0x10

ADD EAX, 0x10

SUB EAX, 0x20

EAX also gets 0

Metamorphic Algorithm

Confidential

Detection Limitation

• Hard to find similar bytes

• Unknown length of bytes

• Unpredictable code

Reversing Stages

Confidential

.text 0xbb000

.rsrc 0x01200

metamorphic

algorithm 0x06C77

MZ header MZ header

.rsrc 0x01200

MZ header

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

metamorphic

algorithm 0x06C77

main functions

At the entry point, the

malware executes its

metamorphic algorithm.

Metamorphic Algorithm (sample 1)

Confidential

~ 28 kilobytes

Call to the decrypted

bytes at the start of the

.text section.

Entry Point

The size of the

metamorphic code varies

per infected file.

Approximately 28kb of

code constitutes the

metamorphic algorithm

that generates the rest of

the malicious code,

including the polymorphic

algorithm.

Confidential

irrelevant bytes

decrypted bytes

first DWORD

second DWORD

third DWORD

Confidential

irrelevant bytes

first DWORD

second DWORD

third DWORD

decrypted bytes

Confidential

irrelevant bytes

decrypted bytes

first DWORD

second DWORD

third DWORD

Confidential

irrelevant bytes

first DWORD

second DWORD

third DWORD

decrypted bytes

Metamorphic Algorithm (comparison)

Confidential

Sample 1

Sample 2

first DWORD

MOV [EDI],ECX

MOV [EAX],ESI

Confidential

Sample 2

second DWORD

Sample 1

MOV [EAX],EBX

MOV [EDI],EBX

Confidential

Sample 2

third DWORD

Sample 1

MOV [EDX],ESI

MOV [EBX],ECX

Metamorphic Algorithm (detection)

Confidential

Sample 2 Sample 1

MOV EAX, --------

JMP 0040108B

Demo – Metamorphic Algorithm

Virlock As A File Infector

Cleaning: How To Clean An Infected File

Confidential

Basics:

• Determine the kind of virus

• Determine how to extract and restore the host

Different Kinds Of File Infectors

Confidential

Basics:

• Appending

• Prepending

• Cavity

• Overwriting

• Companion

Different Kinds Of File Infectors

Confidential

appending prepending cavity

overwriting companion

virlock

Cleaning: Extracting The Host File From Virlock

Confidential

Details:

• Host file is encrypted and embedded within the

malware

• DecryptionKey can be found within the malware

• DecryptionKey is encrypted using a simple XOR

• Uses a simple decryption algorithm to extract the

host file

Reversing Stages

Confidential

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

Host file

Finally, the host file

is decrypted,

dropped, and

executed.

Confidential

EBX = initial key

XORing EBX with dword in [ESI]

generates the DecryptionKey

ECX = EBX = DecryptionKey

EBX = the next DWORD

ESI = location of the encrypted DecryptionKey

Decrypts the

HOST file

Confidential

Decrypts the

HOST file

DecryptionKey

Original Host

Filename Encrypted Host File

Decrypted Host File

Virlock As A Polymorphic Malware

Reversing Stages

Confidential

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main function

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

.rsrc 0x01200

MZ header

metamorphic

algorithm 0x06C77

main functions

on-demand poly

Host file

When an on-demand

polymorphic algorithm

runs, it decrypts the

malicious code and

executes them. Then

re-encrypts itself and

the malicious code

with a different key.

Dynamic Routine Execution Map

Confidential

On-Demand Polymorphic Algorithm

Confidential

Implementation

• Uses Decryptor to decrypt a block of code using

an old key

• Executes the newly decrypted code

• Uses RDTSC (Read Time-Stamp Counter) to

generate a new dword value

• Uses NewKeyGenerator to generate new key

• Uses Encryptor to encrypt the same block of

code using the new key

newly decrypted

Decryptor

Confidential

Features:

• Uses garbage code

• Keygen function for redundancy check

• Uses XOR to generate the key

• Uses XOR to decrypt a block of code

Decryptor

Confidential

garbage code

# of bytes to

generate the key

actual key

generator;

EAX starts with

0xFFFFFFFF

starting location

of key-bytes

XOR decryptor keygen function

generates the

same EAX value

Confidential

Implementation

an old key

newly decrypted

Confidential

Implementation

an old key

newly decrypted

Confidential

Implementation

an old key

newly decrypted

NewKeyGenerator

Confidential

Implementation:

• RDTSC generates a new dword value

• Saves it in different memory locations

• The memory locations are within the memory

range that contains key bytes

• Generates new key by XORing the key bytes

• Saves the new key to the original location of the

old key used in the Decryptor

NewKeyGenerator

Confidential

location of the

bytes needed to

generate the

new key

starting location

is one byte

before the first

DWORD value

from RDTSC

EAX = DWORD value

NEW KEY

NewKeyGenerator

Confidential

NEW KEY

old key

new key

location of the NEW KEY

Confidential

Implementation

an old key

newly decrypted

Confidential

Implementation

an old key

newly decrypted

Encryptor

Confidential

Features:

• Uses the same algorithm as the Decryptor

• Uses the new key to encrypt the same block of

Sample On-demand Polymorphic Values

Confidential

1C B0 19 99

F4 C7 7E 64

E2 40 7B 9A

F4 00 7B F1

E8 B0 62 02

00 C7 05 FF

16 40 00 01

00 00 00 6A

75 EB 89 E2

9D 9C EE 1F

8B 1B EB E1

9D 5B EB 8A

encrypted with OLD KEY

decrypted code

encrypted with NEW KEY

Detection

Confidential

1C B0 19 99

F4 C7 7E 64

E2 40 7B 9A

F4 00 7B F1

E8 B0 62 02

00 C7 05 FF

16 40 00 01

00 00 00 6A

75 EB 89 E2

9D 9C EE 1F

8B 1B EB E1

9D 5B EB 8A

encrypted with OLD KEY

decrypted code

encrypted with NEW KEY

Detection

Confidential

location of the

bytes needed to

generate the

new key

starting location

is one byte

before the first

DWORD value

from RDTSC

EAX = DWORD value

NEW KEY

Detection

Confidential

location of the

bytes needed to

generate the

new key

starting location

is one byte

before the first

DWORD value

from RDTSC

EAX = DWORD value

NEW KEY

Confidential

Virlock As A Ransomware

Visible Signs of Infection

Eradication

Confidential

• Manually create solution to clean the infected

• Download reliable standalone solution to remove

the malware from the system

• Always make sure that your antivirus and

security apps are updated

What if your system is already locked?

Confidential

Steps:

• Reboot the system on safe mode

• Remove the malware entry on the startup

registry

• Then go back to eradication stage

Demo – Unlocking Virlock

Wrap Up

Confidential

• For reversing:

Set a breakpoint at the end of metamorphic

algorithm

Copy the decrypted code from memory

• For detection:

Get patterns from the decrypted code

• For cleaning:

Remove the entries from the registry keys

Extract the host file

Mulțumesc!

GNISREVER A POLYMORPHIC FILE-INFECTING RANSOMWARE … 1... · Malware Honeycomb virus POS bot...

Documents

Botnet hálózatok jellemzői, a Zeus botnet valós képességei, lehetőségei

Ransom Oaks All Ransom Oaks Pools Who-to-Call Openransomoaks.com/wp-content/uploads/newsletter/1908... · RANSOM OAKS NEWS 2 Ransom Oaks Board of Directors RANSOM OAKS is a planned

רשתות BOTNET

Tracing Botnet in Taiwan - FIRST Botnet Analysis Module (BAM) – C&C Tracer – Botnet Tracer The Botnet in Taiwan – Case Study Ⅰ IRC Botnet ... Tracing Botnet in Taiwan Author:

Storm Worm & Botnet

Botnet ppt

Conficker Botnet

Realidade das BotNets Atuais - vx-underground...Um worm apenas? Ou um worm e botnet? Em determinadas data iria gerar o caos!!! Recompensa de US 250k para quem entregar o autor!!! Se

Paper Presentation - "Your Botnet is my Botnet : Analysis of a Botnet Takeover"

Your Botnet is My Botnet: Analysis of a Botnet Takeover · Your Botnet is My Botnet: Analysis of a Botnet Takeover Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin

Diferença entre vírus, spam, spyware, worm, phishing, botnet, rootkit

Storm Worm Botnet Analysis - June 2008

Your Botnet is My Botnet: Analysis of a Botnet TakeoverWhile botnets have been “hijacked” and studied previously, the Torpig botnet exhibits certain properties that make the analysis

Worm DDos Spam - SecurityCN.net · CNCERT/CC CNCERT/CC CNCERTCC_TR_2005-001(Draft) Worm DDos Spam Phishing Spyware Botnet [1] Bot DDos DDos Bot: ±Robo Bot

Your Botnet is My Botnet: Analysis of a Botnet Takeover

Mirai botnet

Gorynch botnet

Botnet Infiltration

Botnet detection using correlated anomalies · deals with machine learning techniques and algorithms used for training botnet ... Botnet detection faces a number of ... Botnet detection

Malware. 2 Inhoud Historisch overzicht Malware Soorten Malware (+ werking) Virus, Worm, Trojan, botnet Andere Terminologie Exploit, Payload, Zero-day